4 added 1187 characters in body
source | link

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

If you are just looking for more feedback about the problems from a conceptual level, probably the largest issue is the matrixes. Your key isn't really your key. The matrixes are your key and they appear to be shared on every message regardless of key. The matrix can be trivially obtained by passing a known key in and sufficient data that all of the grids can be solved algebraically. With the substitution that the matrix offered now neutralized, we move on to the next issue.

The second issue is the way the "key" is applied. Analysing the key given the matrixes is solvable by hand as it is just a basic rotating shift cipher. Simple frequency analysis will allow trivial decoding since every 25th set will receive an identical offset from the one 25 before it. It would not be meaningfully harder than solving a cryptogram in the daily newspaper.

A big part of what makes modern encryption algorithms good is that the key and algorithm are both self-modifying. The way in which substitutions are created is altered both by the key and the plaintext such that it is extremely difficult to work backwards from the plaintext and ciphertext to the key. This takes pretty complicated math to be able to do and is why it is so difficult to both create and even to properly use encryption algorithms.

Even if certain steps aren't taken in the use of an algorithm, it can fail catastrophically. I once saw a situation where RC4 encryption was incorrectly used with no IV to distinguish different plaintexts. Because RC4 builds out a keystream from the key and the plaintext, the lack of an IV allowed trivial decryption with a known plaintext attack. All you had to do was encrypt something of similar length and get the output and then xor the ciphertexts and apply the same xor to the plaintext and you'd get the decrypted value for the same key used.

To be strong, an encryption algorithm must meet a lot of different criteria to resist analysis and building one from scratch that covers them all is notoriously difficult.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

If you are just looking for more feedback about the problems from a conceptual level, probably the largest issue is the matrixes. Your key isn't really your key. The matrixes are your key and they appear to be shared on every message regardless of key. The matrix can be trivially obtained by passing a known key in and sufficient data that all of the grids can be solved algebraically. With the substitution that the matrix offered now neutralized, we move on to the next issue.

The second issue is the way the "key" is applied. Analysing the key given the matrixes is solvable by hand as it is just a basic rotating shift cipher. Simple frequency analysis will allow trivial decoding since every 25th set will receive an identical offset from the one 25 before it. It would not be meaningfully harder than solving a cryptogram in the daily newspaper.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

If you are just looking for more feedback about the problems from a conceptual level, probably the largest issue is the matrixes. Your key isn't really your key. The matrixes are your key and they appear to be shared on every message regardless of key. The matrix can be trivially obtained by passing a known key in and sufficient data that all of the grids can be solved algebraically. With the substitution that the matrix offered now neutralized, we move on to the next issue.

The second issue is the way the "key" is applied. Analysing the key given the matrixes is solvable by hand as it is just a basic rotating shift cipher. Simple frequency analysis will allow trivial decoding since every 25th set will receive an identical offset from the one 25 before it. It would not be meaningfully harder than solving a cryptogram in the daily newspaper.

A big part of what makes modern encryption algorithms good is that the key and algorithm are both self-modifying. The way in which substitutions are created is altered both by the key and the plaintext such that it is extremely difficult to work backwards from the plaintext and ciphertext to the key. This takes pretty complicated math to be able to do and is why it is so difficult to both create and even to properly use encryption algorithms.

Even if certain steps aren't taken in the use of an algorithm, it can fail catastrophically. I once saw a situation where RC4 encryption was incorrectly used with no IV to distinguish different plaintexts. Because RC4 builds out a keystream from the key and the plaintext, the lack of an IV allowed trivial decryption with a known plaintext attack. All you had to do was encrypt something of similar length and get the output and then xor the ciphertexts and apply the same xor to the plaintext and you'd get the decrypted value for the same key used.

To be strong, an encryption algorithm must meet a lot of different criteria to resist analysis and building one from scratch that covers them all is notoriously difficult.

3 deleted 33 characters in body
source | link

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

If you are just looking for more feedback about the problems from a conceptual level, probably the largest issue is the matrixes. Your key isn't really your key. The matrixes are your key and they appear to be shared on every message regardless of key. The matrix can be trivially obtained by passing a known key in and sufficient data that all of the grids can be solved algebraically. With the substitution that the matrix offered now neutralized, we move on to the next issue.

The second issue is the way the "key" is applied. Analysing the key given the matrixes is solvable by hand as it is just a basic rotating shift cipher. Simple frequency analysis will allow trivial decoding since every 25th set will receive an identical offset from the one 25 before it. It would not be meaningfully harder than solving a cryptogram in the daily newspaper.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

If you are just looking for more feedback about the problems from a conceptual level, probably the largest issue is the matrixes. Your key isn't really your key. The matrixes are your key and they appear to be shared on every message regardless of key. The matrix can be trivially obtained by passing a known key in and sufficient data that all of the grids can be solved algebraically. With the substitution that the matrix offered now neutralized, we move on to the next issue.

The second issue is the way the "key" is applied. Analysing the key given the matrixes is solvable by hand as it is just a basic rotating shift cipher. Simple frequency analysis will allow trivial decoding since every 25th set will receive an identical offset from the one 25 before it. It would not be meaningfully harder than solving a cryptogram in the daily newspaper.

2 deleted 33 characters in body
source | link

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a shift and substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, it looks like you can probably trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a shift and substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, it looks like you can probably trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

First rule of security.. don't roll your own. There are many types of analysis that will rip this system apart as it is an incredibly simple encryption scheme. I didn't bother doing a full analysis, but it appears to largely just be a substitution cipher which can be pretty easily analysed even without a known plaintext.

With a known plaintext and encrypted value, you can trivially do a known plain text attack and it will fall apart completely because it will reveal the key and allow decryption of anything else.

This is why the "don't roll your own" rule exists. It's hard enough to apply secure cryptographic algorithms correctly even when using established and extensively reviewed algorithms. Trying to make your own algorithm is an exceptionally difficult process that requires extensive review and probably millions of dollars to develop and validate.

1
source | link